fix: add regex for read api user field

Add regex to assert that read API's user field (if specified) must
have both type and object.

Close openfga/openfga#2189

openfga/v1/openfga_service.proto

@@ -36,7 +36,8 @@ service OpenFGAService {
         "1. `tuple_key` is optional. If not specified, it will return all tuples in the store.\n"
         "2. `tuple_key.object` is mandatory if `tuple_key` is specified. It can be a full object (e.g., "
         "`type:object_id`) or type only (e.g., `type:`).\n"
-        "3. `tuple_key.user` is mandatory if tuple_key is specified in the case the `tuple_key.object` is a type only.\n"
+        "3. `tuple_key.user` is mandatory if tuple_key is specified in the case the `tuple_key.object` is a type only. "
+        "If tuple_key.user is specified, it needs to be a full object (e.g., `type:user_id`).\n"
         "## Examples\n"
         "### Query for all objects in a type definition\n"
         "To query for all objects that `user:bob` has `reader` relationship in "
@@ -1190,7 +1191,11 @@ message ReadRequest {
 
 message ReadRequestTupleKey {
   string user = 1 [
-    (validate.rules).string = {max_bytes: 512},
+    (validate.rules).string = {
+      pattern: "^[^\\s]{1,511}:[^\\s]{1,511}$"
+      ignore_empty: true
+      max_bytes: 512
+    },
     (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
       max_length: 512
       example: "\"user:anne\""